The real gotcha that people skip over is waiting long enough - I see folks seal grout after 72 hours and wonder why it fails in two years, when the grout honestly needs closer to two weeks to fully cure, especially in a damp bathroom. Your tile setter should've told you this, but most don't. Beyond that, penetrating sealers are solid for natural stone and unsealed porcelain, but if you've got glazed ceramic tiles (which most shower installations do), a membrane sealer that sits on top works better and lasts longer - it physically blocks water rather than relying on the grout staying porous in a way that lets it breathe. The application itself is straightforward: clean the grout lines completely, let them dry, apply the sealer with a small brush or applicator bottle so it fills the line without flooding your tile faces, then let it cure per the product instructions before you shower again.